Getting Started with BPF Security Observability
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 11:25· Room 0E-2 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
eBPF attaches tiny programs to kernel control paths to capture execsnoop and opensnoop events, trace TCP connects, file opens/reads/writes and scheduler or memory leaks with near real‑time, no‑app‑disruption visibility. Toolchain specifics: write in C/Rust/Python, compile with clang/LLVM, load via libbpf or BCC, run one‑liners with bpftrace; verifier prevents infinite loops; LSM hooks (kernel 5.7+) enable security callbacks. Demonstrations use BCC tools to show process lifecycle, socket lifecycle and file access and they work as a practical getting‑started path.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:47What is BPF and security
- 7:10BPF toolchain and ecosystem
- 11:08Security observability concepts
- 14:01Four golden signals
- 20:07Process lifecycle monitoring
- 27:20Demo: BCC process execution
- 29:31Network socket monitoring
- 32:29Demo: BCC TCP connections
- 35:13File access monitoring
- 39:03Demo: BCC file operations
- 42:16BPF instrumentation types
- 46:20Writing BPF programs in C
- 52:24Summary
related talks
32meBPF: The Next Power Tool of SREs
16mWhy Everyone Should Care About eBPF
36meBPF for Runtime Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
20mClosing Perspectives
29meBPF on the Rise - Getting Started
31meBPF for Observability: The Good, the Bad, and the Ugly
33meBPF: exploring use case of BPF kernel infrastructure